Executive Summary

This vulnerability in GitLab CE/EE allowed an authenticated attacker with reporter access to view branch names and pipeline details by accessing the packages API endpoint, even when repository access was disabled. It affected all versions from 13.2 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability could allow an attacker with reporter access to gain unauthorized visibility into branch names and pipeline details, potentially exposing sensitive project structure information, which could be used for further attacks or information gathering.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade GitLab CE/EE to versions 18.3.6 or later, 18.4.4 or later, or 18.5.2 or later, as these versions contain the fix that prevents authenticated users with reporter access from viewing branch names and pipeline details via the packages API endpoint when repository access is disabled.

Useful 0 Not Useful 0